Red Hat Linux Security Advisories & CVEs
5615 advisories tracked · Red Hat Security Data API · direct feeds checked every minute; rate-limited backstops use a safe source cadence
Android app · Google Play
Monitor Red Hat CVEs from your phone.
Choose a whole vendor or a precise platform, then receive matching security advisories by phone notification, email, or both. Coverage follows 34 official vendor sources and 160+ reviewed platform categories.
Security advisories for your Red Hat release
Pick your distribution release to see every advisory issued for it and its severity mix. Fixes ship as errata — keep the system patched. This is the release's advisory history, not a per-package scan.
Official source
Red Hat Security Data API
Red Hat Enterprise Linux errata (RHSA) via the official Red Hat Security Data API — CVE severity, CVSS and affected packages. A credential-free official source.
Latest Red Hat advisories
Medium [CVE-2026-90828] Null pointer dereference via elf_orphan_compatible function
Null pointer dereference via elf_orphan_compatible function. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-476. Red Hat lists fixing advisory RHSA-2026:47171 with package binutils-main-2.46.1-1.1.hum1. Affected product named by the advisory: Red Hat Hardened Images.
Medium [CVE-2026-94282] OOB read in XI2 enter/leave/focus cookie conversion (`wireToEnterLeave`)
OOB read in XI2 enter/leave/focus cookie conversion (`wireToEnterLeave`). Red Hat rates this moderate (CVSS 6.1).
Medium [CVE-2026-64753] Processing maliciously crafted web content may disclose sensitive user information
Processing maliciously crafted web content may disclose sensitive user information. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-359. Red Hat lists fixing advisory RHSA-2026:69098 with package webkit2gtk3-0:2.54.0-1.el9_8, webkit2gtk3-0:2.54.0-1.el8_10. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat Enterprise Linux 8.
Medium [CVE-2026-53716] Denial of Service via uncontrolled gzip decompression of Wasm HTTP fetch
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, getFileFromGZ in internal/wasm/httpfetcher.go calls io.ReadAll on a gzip. Reader without limiting decompressed output when a tenant-controlled EnvoyExtensionPolicy.spec.wasm[].code.http.url points to a reachable compressed Wasm payload. The 256 MiB compressed-input cap does not constrain the expanded size, no operator Wasm URL allowlist exists, and the optional sha256 check occurs only after decompression, so a comparatively small gzip stream can force a multi-gigabyte allocation in the shared controller. The resulting out-of-memory termination restarts the controller, re-reconciles the persistent custom resource, and can create a persistent cross-tenant control-plane outage. This issue is fixed in versions 1.7.4 and 1.8.1. A remote attacker, by providing a specially crafted compressed WebAssembly (Wasm) payload through a tenant-controlled URL, can exploit a vulnerability where the system decompresses the gzip file without limiting the output size. This can lead to an uncontrolled memory allocation, causing the controller to terminate due to out-of-memory conditions. The resulting restarts can cause a persistent denial of service across multiple tenants. RH Connectivity Link includes an affected Envoy Gateway version.
Medium [CVE-2026-53715] Denial of Service via Wasm cache improper synchronization
Envoy Gateway is an open source project for managing Envoy Proxy as a standalone or Kubernetes-based application gateway. Prior to 1.7.4 and 1.8.1, HTTPServer. ServeHTTP in internal/wasm/httpserver.go reads the plain mappingPath2Cache map without synchronization while HTTPServer. Get writes the same map during EnvoyExtensionPolicy translation. An attacker with pod-network access to unauthenticated port 18002 and tenant permission to churn policies with distinct Wasm URLs can flood GET requests until a per-request reader overlaps a writer. Go's concurrent map read and write detection invokes runtime.throw, which the net/http connection recovery cannot catch, terminating the controller process and causing a timing-dependent, cross-tenant control-plane denial of service until Kubernetes restarts the pod. This issue is fixed in versions 1.7.4 and 1.8.1. Improper synchronization in the Wasm cache handling allows an attacker with pod-network access and tenant permissions to trigger a race condition. By flooding GET requests, an attacker can cause a read-write overlap, leading to the termination of the controller process. Red Hat Connectivity Link includes an affected Envoy Gateway version below 1.7.4. Affected product named by the advisory: Red Hat Connectivity Link 1.
Medium [CVE-2026-53718] Cross-namespace authorization bypass
Cross-namespace authorization bypass. Red Hat rates this moderate (CVSS 6.4). Weakness: CWE-862. Affected product named by the advisory: Red Hat Connectivity Link 1.
Medium [CVE-2026-90816] CPU exhaustion when processing a crafted HLS playlist
CPU exhaustion when processing a crafted HLS playlist. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-835. Affected product named by the advisory: Red Hat OpenShift AI (RHOAI).
Medium [CVE-2026-90815] out-of-bounds read in the Convolution Filter
out-of-bounds read in the Convolution Filter. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-125. Affected product named by the advisory: Red Hat OpenShift AI (RHOAI).
Medium [CVE-2026-47256] github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter: opentelemetry-collector-contrib: OpenTelemetry Sentry Exporter: Path traversal allows unauthorized access to Sentr…
github.com/open-telemetry/opentelemetry-collector-contrib/exporter/sentryexporter: opentelemetry-collector-contrib: OpenTelemetry Sentry Exporter: Path traversal allows unauthorized access to Sentry API endpoints. Red Hat rates this moderate (CVSS 6.5). Weakness: CWE-22. Red Hat lists fixing advisory RHSA-2026:63152 with package opentelemetry-collector-contrib-main-0.160.0-0.1.hum1. Affected product named by the advisory: Red Hat Hardened Images.
Medium [CVE-2026-53495] Denial of Service via CRI ExecSync goroutine leak
Denial of Service via CRI ExecSync goroutine leak. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-772. Affected products named by the advisory: Assisted Installer for Red Hat OpenShift Container Platform 2; AWS Load Balancer Operator; Compliance Operator; Confidential Compute Attestation; and 42 more. Affected products named by the advisory: Custom Metric Autoscaler operator for Red Hat Openshift; Deployment Validation Operator; Gatekeeper 3; Logging Subsystem for Red Hat OpenShift; and 38 more.
Medium [CVE-2026-90804] Buffer overflow in Eh Frame Section Handler can lead to denial of service
Buffer overflow in Eh Frame Section Handler can lead to denial of service. Red Hat rates this moderate (CVSS 4.8). Weakness: CWE-805. Red Hat lists fixing advisory RHSA-2026:47171 with package binutils-main-2.46.1-1.1.hum1. Affected product named by the advisory: Red Hat Hardened Images.
Medium [CVE-2026-55073] Local file read and Server-Side Request Forgery (SSRF) via URL fetcher bypass
Local file read and Server-Side Request Forgery (SSRF) via URL fetcher bypass. Red Hat rates this moderate (CVSS 6.2). Weakness: CWE-1220.
Medium [CVE-2026-90803] GNU Binutils ld: Buffer Overflow via Malformed Relocation
GNU Binutils ld: Buffer Overflow via Malformed Relocation. Red Hat rates this moderate (CVSS 6.6). Weakness: CWE-805. Red Hat lists fixing advisory RHSA-2026:47171 with package binutils-main-2.46.1-1.1.hum1. Affected product named by the advisory: Red Hat Hardened Images.
Medium [CVE-2026-90802] Denial of service via null pointer dereference in ld component
Denial of service via null pointer dereference in ld component. Red Hat rates this moderate (CVSS 5). Weakness: CWE-476. Red Hat lists fixing advisory RHSA-2026:47171 with package binutils-main-2.46.1-1.1.hum1. Affected product named by the advisory: Red Hat Hardened Images.
Medium [CVE-2026-90801] GNU Binutils ld: Buffer overflow in cache_bwrite via nbytes manipulation
GNU Binutils ld: Buffer overflow in cache_bwrite via nbytes manipulation. Red Hat rates this moderate (CVSS 5.3). Weakness: CWE-120. Red Hat lists fixing advisory RHSA-2026:47171 with package binutils-main-2.46.1-1.1.hum1. Affected product named by the advisory: Red Hat Hardened Images.
Medium [CVE-2026-90996] Denial of Service in NSS responder via crafted zero-length requests
Denial of Service in NSS responder via crafted zero-length requests. Red Hat rates this moderate (CVSS 4). Weakness: CWE-191. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat OpenShift Container Platform 4.
Medium [CVE-2026-90995] Local denial of service due to NULL pointer dereference in PAM responder
Local denial of service due to NULL pointer dereference in PAM responder. Red Hat rates this moderate (CVSS 5.5). Weakness: CWE-476. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 6; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; and 3 more. Affected products named by the advisory: Red Hat Enterprise Linux 9; Red Hat OpenShift Container Platform 4; Red Hat package: sssd.
Medium [CVE-2026-90994] Denial of Service via malformed PAM v1 requests
Denial of Service via malformed PAM v1 requests. Red Hat rates this moderate (CVSS 4). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat OpenShift Container Platform 4.
Medium [CVE-2025-24890] Privilege escalation via incorrect repository trust on Windows
Privilege escalation via incorrect repository trust on Windows. Red Hat rates this moderate (CVSS 6.8). Weakness: CWE-648.
Medium [CVE-2026-90463] Local OOB Read in NSS Service Request Parsers (`sss_nss_protocol_parse_svc_name` / `sss_nss_protocol_parse_svc_port`)
Local OOB Read in NSS Service Request Parsers (`sss_nss_protocol_parse_svc_name` / `sss_nss_protocol_parse_svc_port`). Red Hat rates this low (CVSS 4). Weakness: CWE-125. Affected products named by the advisory: Red Hat Enterprise Linux 10; Red Hat Enterprise Linux 7; Red Hat Enterprise Linux 8; Red Hat Enterprise Linux 9; and 1 more. Affected products named by the advisory: Red Hat OpenShift Container Platform 4.